tba-app-backend-core 0.4.0.dev2__py3-none-any.whl

tba_app_backend_core/surfaces/advanced_protocols.py

@@ -0,0 +1,170 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import asdict, is_dataclass
+from datetime import date, datetime
+from typing import Any
+
+from tigrbl import TigrblApp, TigrblRouter
+from tba_contracts_identity.attestation import AttestationEvidence
+from tigrbl import Request
+from tigrbl.runtime.status import HTTPException, status
+
+api = TigrblRouter()
+
+
+def _components(request: Request) -> Mapping[str, object]:
+    app = getattr(request, "app", None)
+    state = getattr(app, "state", None)
+    components = getattr(state, "tba_protocol_components", None)
+    return components if isinstance(components, Mapping) else {}
+
+
+def _component(request: Request, name: str) -> object:
+    component = _components(request).get(name)
+    if component is None:
+        raise HTTPException(
+            status.HTTP_503_SERVICE_UNAVAILABLE,
+            f"{name} protocol component is not configured",
+        )
+    return component
+
+
+async def _payload(request: Request) -> Mapping[str, Any]:
+    value = await request.json()
+    if not isinstance(value, Mapping):
+        raise HTTPException(
+            status.HTTP_400_BAD_REQUEST, "request body must be an object"
+        )
+    return value
+
+
+def _jsonable(value: object) -> object:
+    if is_dataclass(value) and not isinstance(value, type):
+        return _jsonable(asdict(value))
+    if isinstance(value, Mapping):
+        return {str(key): _jsonable(item) for key, item in value.items()}
+    if isinstance(value, (tuple, list, set, frozenset)):
+        return [_jsonable(item) for item in value]
+    if isinstance(value, (datetime, date)):
+        return value.isoformat()
+    if isinstance(value, bytes):
+        return value.hex()
+    return value
+
+
+@api.route("/credential", methods=["POST"], include_in_schema=True, tags=["oid4vci"])
+async def issue_credential(request: Request) -> object:
+    payload = await _payload(request)
+    protocol = _component(request, "oid4vci")
+    try:
+        result = protocol.credential(
+            payload,
+            wallet_attestation=request.headers.get("OAuth-Client-Attestation"),
+        )
+    except (LookupError, PermissionError, ValueError) as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
+    return _jsonable(result)
+
+
+@api.route(
+    "/presentation/verify", methods=["POST"], include_in_schema=True, tags=["oid4vp"]
+)
+async def verify_presentation(request: Request) -> object:
+    payload = await _payload(request)
+    holder, vp_token, authorization_request = (
+        payload.get("holder"),
+        payload.get("vp_token"),
+        payload.get("authorization_request"),
+    )
+    if (
+        not isinstance(holder, str)
+        or not isinstance(vp_token, (str, bytes))
+        or not isinstance(authorization_request, Mapping)
+    ):
+        raise HTTPException(
+            status.HTTP_400_BAD_REQUEST,
+            "holder, vp_token, and authorization_request are required",
+        )
+    try:
+        result = _component(request, "oid4vp").verify(
+            holder, vp_token, authorization_request
+        )
+    except ValueError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
+    return _jsonable(result)
+
+
+@api.route(
+    "/access/v1/evaluation", methods=["POST"], include_in_schema=True, tags=["authzen"]
+)
+async def evaluate_access(request: Request) -> object:
+    try:
+        return _component(request, "authzen").access_evaluation(await _payload(request))
+    except ValueError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
+
+
+@api.route("/gnap/tx", methods=["POST"], include_in_schema=True, tags=["gnap"])
+async def process_gnap(request: Request) -> object:
+    handler = _component(request, "gnap")
+    from tba_protocol_gnap import parse_gnap_request
+
+    try:
+        parsed = parse_gnap_request(await _payload(request))
+        result = handler(parsed)
+    except ValueError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
+    return _jsonable(result)
+
+
+@api.route(
+    "/security-events/receive", methods=["POST"], include_in_schema=True, tags=["set"]
+)
+async def receive_security_event(request: Request) -> object:
+    payload = await _payload(request)
+    token = payload.get("set")
+    if not isinstance(token, str):
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "set token is required")
+    try:
+        event = _component(request, "security_events").receive(token)
+    except ValueError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
+    return _jsonable(event)
+
+
+@api.route(
+    "/attestations/appraise",
+    methods=["POST"],
+    include_in_schema=True,
+    tags=["attestation"],
+)
+async def appraise_attestation(request: Request) -> object:
+    payload = await _payload(request)
+    profile, claims, raw = (
+        payload.get("profile"),
+        payload.get("claims"),
+        payload.get("raw"),
+    )
+    if (
+        not isinstance(profile, str)
+        or not isinstance(claims, Mapping)
+        or (raw is not None and not isinstance(raw, str))
+    ):
+        raise HTTPException(
+            status.HTTP_400_BAD_REQUEST, "profile and claims are required"
+        )
+    evidence = AttestationEvidence(profile, dict(claims), raw)
+    return _jsonable(await _component(request, "attestation").appraise(evidence))
+
+
+def include_advanced_protocols(app: TigrblApp) -> None:
+    existing = {
+        getattr(route, "path", None) or getattr(route, "path_template", None)
+        for route in getattr(getattr(app, "router", app), "routes", ())
+    }
+    if "/credential" not in existing:
+        app.include_router(api)
+
+
+__all__ = ["api", "include_advanced_protocols"]

tba_app_backend_core/surfaces/auth_flows.py

@@ -0,0 +1,16 @@
+"""OAuth/OIDC login and authorization-flow route composition."""
+
+from __future__ import annotations
+
+from tigrbl import TigrblRouter
+
+from .authz_surface import router as authz_router
+from .introspection_surface import router as introspection_router
+from .login_surface import router as login_router
+
+router = TigrblRouter()
+router.include_router(login_router)
+router.include_router(authz_router)
+router.include_router(introspection_router)
+
+__all__ = ["router"]

tba_app_backend_core/surfaces/authorization_server_metadata_surface.py

@@ -0,0 +1,37 @@
+"""Runtime composition for the RFC 8414 HTTP carrier."""
+
+from tigrbl import TigrblApp
+from tba_router_oauth_authorization_server_metadata import (
+    build_authorization_server_metadata_router,
+    include_authorization_server_metadata,
+)
+from tba_protocol_oauth.standards.authorization_server_metadata import (
+    RFC8414_METADATA_PATH,
+)
+from tba_runtime_identity.deployment import deployment_from_app
+from tba_runtime_identity.settings import settings
+
+from tba_server_identity.authorization_server_metadata_runtime import (
+    authorization_server_metadata,
+)
+
+
+router = build_authorization_server_metadata_router(
+    authorization_server_metadata=authorization_server_metadata,
+)
+api = router
+
+
+def include_rfc8414(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_authorization_server_metadata(
+        app,
+        router,
+        enabled=(
+            bool(settings.enable_rfc8414)
+            and deployment.route_enabled(RFC8414_METADATA_PATH)
+        ),
+    )
+
+
+__all__ = ["api", "include_rfc8414", "router"]

tba_app_backend_core/surfaces/authorization_surface.py

@@ -0,0 +1,15 @@
+"""Runtime composition for the OAuth/OIDC authorization HTTP carrier."""
+
+from tba_router_oauth_authorization import build_authorization_router
+from tba_runtime_identity_storage.engine import get_db
+
+from tba_server_identity.authorization_runtime import authorize_request
+
+
+router = build_authorization_router(
+    authorize_request=authorize_request,
+    get_db=get_db,
+)
+
+
+__all__ = ["authorize_request", "router"]

tba_app_backend_core/surfaces/authz_surface.py

@@ -0,0 +1,14 @@
+"""Legacy authorization and token route composition."""
+
+from __future__ import annotations
+
+from tigrbl import TigrblRouter
+
+from .authorization_surface import router as authorize_router
+from .token_surface import router as token_router
+
+router = TigrblRouter()
+router.include_router(authorize_router)
+router.include_router(token_router)
+
+__all__ = ["router"]

tba_app_backend_core/surfaces/client_registration_surface.py

@@ -0,0 +1,366 @@
+"""Runtime security, policy, and composition for RFC 7591 and RFC 7592."""
+
+from __future__ import annotations
+
+import inspect
+import secrets
+from pathlib import Path
+from uuid import UUID, uuid4
+
+from tigrbl import Request, TigrblApp
+from tigrbl.runtime.status import HTTPException, status
+from tba_router_oauth_registration import (
+    build_client_registration_router,
+    include_client_registration_endpoint as include_http_registration_endpoint,
+)
+from tba_protocol_oauth.schemas import (
+    DynamicClientRegistrationIn,
+    DynamicClientRegistrationManagementIn,
+)
+from tba_protocol_oauth.standards.client_registration_management import (
+    RFC7592ClientRegistrationManagementService,
+)
+from tba_protocol_oauth.standards.dynamic_client_registration import (
+    RFC7591DynamicClientRegistrationService,
+)
+from tba_protocol_oauth.standards.oauth_security_bcp import (
+    runtime_security_profile,
+)
+from tba_contracts_identity.oauth import (
+    ClientRegistrationCreateRequest,
+    ClientRegistrationRecord,
+    ClientRegistrationUpdateRequest,
+)
+from tba_primitives_identity.constant_time import text_equal
+from tba_primitives_identity.digests import token_hash
+from tba_provider_secret_hashing_bcrypt import hash_pw
+from tba_runtime_identity.deployment import (
+    deployment_from_app,
+    deployment_from_request,
+    resolve_deployment,
+)
+from tba_runtime_identity.settings import settings
+from tba_storage_core.tables import Tenant
+from tba_runtime_identity_storage.engine import get_db
+from tigrbl import (
+    create_record,
+    first_record,
+    read_record,
+)
+from tba_runtime_identity_storage.tenant_state import enabled_tenant_record
+
+from tba_server_identity.security.client_registration import (
+    build_client_registration_capability,
+)
+from tba_server_identity.client_registration_support import (
+    bearer_token as _bearer_token,
+    merge_registration_metadata as _merge_registration_metadata,
+    registration_response as _registration_response,
+    validate_registration_metadata,
+    validate_token_endpoint_auth_method as _validated_token_endpoint_auth_method,
+)
+
+
+def _tenant_from_operator_record(
+    record: dict[str, object], *, tenant_slug: str
+) -> Tenant | None:
+    data = record.get("data") if isinstance(record.get("data"), dict) else {}
+    sql_tenant_id = record.get("sql_tenant_id") or data.get("sql_tenant_id")
+    if not sql_tenant_id:
+        return None
+    try:
+        tenant_id = UUID(str(sql_tenant_id))
+    except ValueError:
+        return None
+    base_name = (
+        str(record.get("name") or data.get("name") or "Tenant").strip() or "Tenant"
+    )
+    return Tenant(
+        id=tenant_id,
+        slug=tenant_slug,
+        name=f"{base_name}-{tenant_slug}"[:120],
+        email=f"{tenant_slug}@tenant.local"[:120],
+    )
+
+
+async def _resolve_registration_tenant(*, db, tenant_slug: str) -> Tenant:
+    tenant = await first_record(Tenant, db, {"slug": tenant_slug})
+    if tenant is not None:
+        return tenant
+    record = enabled_tenant_record(Path.cwd(), tenant_slug)
+    if record is None:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "tenant not found")
+    tenant = _tenant_from_operator_record(record, tenant_slug=tenant_slug)
+    if tenant is not None:
+        payload = {
+            "id": tenant.id,
+            "slug": tenant.slug,
+            "name": tenant.name,
+            "email": tenant.email,
+        }
+    else:
+        base_name = str(record.get("name") or "Tenant").strip() or "Tenant"
+        payload = {
+            "slug": tenant_slug,
+            "name": f"{base_name}-{tenant_slug}"[:120],
+            "email": f"{tenant_slug}@tenant.local"[:120],
+        }
+    try:
+        return await create_record(Tenant, db, payload)
+    except Exception as exc:
+        tenant = await first_record(Tenant, db, {"slug": tenant_slug})
+        if tenant is None:
+            raise HTTPException(
+                status.HTTP_409_CONFLICT,
+                "tenant materialization conflict",
+            ) from exc
+        return tenant
+
+
+async def _validated_registration_payload(
+    *,
+    db,
+    payload: DynamicClientRegistrationIn,
+    deployment=None,
+) -> tuple[Tenant, dict[str, object]]:
+    deployment = deployment if deployment is not None else resolve_deployment(settings)
+    policy = runtime_security_profile(deployment)
+    tenant = await _resolve_registration_tenant(
+        db=db,
+        tenant_slug=payload.tenant_slug,
+    )
+    derived_metadata = validate_registration_metadata(payload, policy=policy)
+    return tenant, derived_metadata
+
+
+def _deployment(request: Request):
+    if getattr(request, "app", None) is not None:
+        return deployment_from_request(request, settings)
+    return resolve_deployment(settings)
+
+
+def _rfc7591_service(request: Request, db):
+    deployment = _deployment(request)
+    return RFC7591DynamicClientRegistrationService(
+        build_client_registration_capability(db),
+        enabled=deployment.flag_enabled("enable_rfc7591"),
+    )
+
+
+def _rfc7592_service(request: Request, db):
+    deployment = _deployment(request)
+    return RFC7592ClientRegistrationManagementService(
+        build_client_registration_capability(db),
+        enabled=deployment.flag_enabled("enable_rfc7592"),
+    )
+
+
+async def register_client(
+    request: Request,
+    db,
+    payload: DynamicClientRegistrationIn,
+) -> dict[str, object]:
+    deployment = _deployment(request)
+    if not deployment.flag_enabled("enable_rfc7591"):
+        raise HTTPException(
+            status.HTTP_404_NOT_FOUND,
+            "dynamic client registration disabled",
+        )
+    tenant, derived_metadata = await _validated_registration_payload(
+        db=db,
+        payload=payload,
+        deployment=deployment,
+    )
+    policy = runtime_security_profile(deployment)
+    client_id = str(uuid4())
+    client_secret = secrets.token_urlsafe(32)
+    registration_access_token = None
+    registration_access_token_hash = None
+    registration_client_uri = None
+    if deployment.flag_enabled("enable_rfc7592"):
+        registration_access_token = secrets.token_urlsafe(32)
+        registration_access_token_hash = token_hash(registration_access_token)
+        registration_client_uri = (
+            f"{str(deployment.issuer or settings.issuer).rstrip('/')}"
+            f"/register/{client_id}"
+        )
+    metadata = _merge_registration_metadata(
+        payload,
+        derived_metadata=derived_metadata,
+    )
+    record = await _rfc7591_service(request, db).register(
+        ClientRegistrationCreateRequest(
+            client_id=client_id,
+            tenant_id=str(tenant.id),
+            client_secret_hash=hash_pw(client_secret),
+            redirect_uris=tuple(payload.redirect_uris),
+            grant_types=tuple(payload.grant_types),
+            response_types=tuple(payload.response_types),
+            metadata=metadata,
+            contacts=tuple(str(item) for item in payload.contacts or ()),
+            software_id=payload.software_id,
+            software_version=payload.software_version,
+            registration_access_token_hash=registration_access_token_hash,
+            registration_client_uri=registration_client_uri,
+        )
+    )
+    commit = getattr(db, "commit", None)
+    if callable(commit):
+        committed = commit()
+        if inspect.isawaitable(committed):
+            await committed
+    suppress_secret = policy.fapi_mode and (
+        payload.token_endpoint_auth_method in set(policy.allowed_client_auth_methods)
+    )
+    return _registration_response(
+        record,
+        registration_access_token=registration_access_token,
+        client_secret=None if suppress_secret else client_secret,
+    )
+
+
+async def _require_registration_access(
+    request: Request,
+    db,
+    client_id: str,
+) -> tuple[ClientRegistrationRecord, str]:
+    try:
+        normalized_client_id = str(UUID(str(client_id)))
+    except ValueError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, "invalid client_id") from exc
+    service = _rfc7592_service(request, db)
+    if not service.enabled:
+        raise HTTPException(
+            status.HTTP_404_NOT_FOUND,
+            "dynamic client registration management disabled",
+        )
+    record = await service.get(normalized_client_id)
+    if record is None or record.disabled_at is not None or not record.client_active:
+        raise HTTPException(
+            status.HTTP_404_NOT_FOUND,
+            "client registration not found",
+        )
+    bearer = _bearer_token(request)
+    if not bearer:
+        raise HTTPException(
+            status.HTTP_401_UNAUTHORIZED,
+            {
+                "error": "invalid_token",
+                "error_description": "registration access token required",
+            },
+        )
+    presented_hash = token_hash(bearer)
+    if not record.registration_access_token_hash or not text_equal(
+        presented_hash,
+        record.registration_access_token_hash,
+    ):
+        raise HTTPException(
+            status.HTTP_401_UNAUTHORIZED,
+            {
+                "error": "invalid_token",
+                "error_description": "invalid registration access token",
+            },
+        )
+    return record, bearer
+
+
+async def get_registered_client(
+    request: Request,
+    db,
+    client_id: str,
+) -> dict[str, object]:
+    record, bearer = await _require_registration_access(request, db, client_id)
+    return _registration_response(record, registration_access_token=bearer)
+
+
+async def update_registered_client(
+    request: Request,
+    db,
+    client_id: str,
+    payload: DynamicClientRegistrationManagementIn,
+) -> dict[str, object]:
+    record, bearer = await _require_registration_access(request, db, client_id)
+    current = dict(record.metadata)
+    tenant = await read_record(Tenant, db, record.tenant_id)
+    current.setdefault("tenant_slug", tenant.slug if tenant is not None else "public")
+    current.setdefault("redirect_uris", list(record.redirect_uris))
+    current.setdefault("grant_types", list(record.grant_types))
+    current.setdefault("response_types", list(record.response_types))
+    current.setdefault("token_endpoint_auth_method", "client_secret_basic")
+    incoming = payload.model_dump(exclude_none=True)
+    current.update(incoming)
+    validated = DynamicClientRegistrationIn(**current)
+    _, derived_metadata = await _validated_registration_payload(
+        db=db,
+        payload=validated,
+        deployment=_deployment(request),
+    )
+    metadata = _merge_registration_metadata(
+        validated,
+        derived_metadata=derived_metadata,
+    )
+    changed = await _rfc7592_service(request, db).update(
+        ClientRegistrationUpdateRequest(
+            client_id=record.client_id,
+            redirect_uris=tuple(validated.redirect_uris),
+            grant_types=tuple(validated.grant_types),
+            response_types=tuple(validated.response_types),
+            metadata=metadata,
+            contacts=tuple(str(item) for item in validated.contacts or ()),
+            software_id=validated.software_id,
+            software_version=validated.software_version,
+            updated_fields=tuple(sorted(incoming)),
+        )
+    )
+    return _registration_response(changed, registration_access_token=bearer)
+
+
+async def delete_registered_client(
+    request: Request,
+    db,
+    client_id: str,
+) -> dict[str, object]:
+    record, _ = await _require_registration_access(request, db, client_id)
+    disabled = await _rfc7592_service(request, db).delete(record.client_id)
+    return {"status": "deleted", "client_id": disabled.client_id}
+
+
+router = build_client_registration_router(
+    register_client=register_client,
+    get_registration=get_registered_client,
+    update_registration=update_registered_client,
+    delete_registration=delete_registered_client,
+    get_db=get_db,
+)
+
+
+def include_client_registration_endpoint(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_http_registration_endpoint(
+        app,
+        router,
+        registration_enabled=deployment.flag_enabled("enable_rfc7591"),
+        management_enabled=deployment.flag_enabled("enable_rfc7592"),
+    )
+
+
+include_rfc7591 = include_client_registration_endpoint
+include_rfc7592 = include_client_registration_endpoint
+
+
+__all__ = [
+    "_bearer_token",
+    "_merge_registration_metadata",
+    "_registration_response",
+    "_require_registration_access",
+    "_validated_registration_payload",
+    "_validated_token_endpoint_auth_method",
+    "delete_registered_client",
+    "get_registered_client",
+    "include_client_registration_endpoint",
+    "include_rfc7591",
+    "include_rfc7592",
+    "register_client",
+    "router",
+    "update_registered_client",
+]

tba_app_backend_core/surfaces/device_authorization_surface.py

@@ -0,0 +1,44 @@
+"""Runtime composition for the RFC 8628 device-authorization carrier."""
+
+from tigrbl import TigrblApp
+from tba_router_oauth_device_authorization import (
+    build_device_authorization_router,
+    include_device_authorization_endpoint as include_device_carrier,
+)
+from tba_runtime_identity.deployment import deployment_from_app
+from tba_runtime_identity.settings import settings
+from tba_runtime_identity_storage.engine import get_db
+
+from tba_server_identity.device_authorization_runtime import (
+    device_authorization,
+    device_authorization_request,
+)
+
+
+router = build_device_authorization_router(
+    device_authorization_request=device_authorization,
+    get_db=get_db,
+)
+api = router
+
+
+def include_device_authorization_endpoint(app: TigrblApp) -> None:
+    deployment = deployment_from_app(app, settings)
+    include_device_carrier(
+        app,
+        router,
+        enabled=deployment.route_enabled("/device_authorization"),
+    )
+
+
+include_rfc8628 = include_device_authorization_endpoint
+
+
+__all__ = [
+    "api",
+    "device_authorization",
+    "device_authorization_request",
+    "include_device_authorization_endpoint",
+    "include_rfc8628",
+    "router",
+]